Subject: Lunch meeting Chicago Tuesday 11:30

From: Chris Newman <[email-masked]>
Date: Fri, 21 Aug 1998 09:37:57 -0700 (PDT)

I would like to propose a Lunch meeting on Tuesday at 11:30 PM (meet by
IETF registration desk) to discuss the issue of mandatory authentication
mechanisms in the applications area.

If the applications area comes to rough concensus behind a particular
strategy for mandatory-to-implement authentication mechanisms, then it
might just be possible to get buy-in from the security area.  As long as
there is disagreement in the applications area, it seems fairly clear
nothing will happen and CRAM-MD5 will remain the only choice.

I am looking for people who actively develop email, LDAP, HTTP or other
app-level products to participate.  The goal would be to get agreement on
how to move towards a single multi-protocol authentication mechanism
that's mandatory-to-implement (and possibly a second mechanism that's
recommended).

		- Chris

---

From: [email-masked]
Date: Fri, 21 Aug 1998 10:42:50 -0700

> mechanisms in the applications area.

this is an important discussion. Chris has also taken the time to write up the 
issues in one place..

http://info.internet.isi.edu:80/in-drafts/files/
  draft-newman-auth-mandatory-00.txt

..which is probably good pre-reading for the discussion. 

Jeff

---

From: Bruce Greenblatt <[email-masked]>
Date: Fri, 21 Aug 1998 10:49:39 -0700

For those of us unfortunate enough to be unable to make it to Chicago, can
someone (Chris?) please take notes, and post them to the appropriate mailing
lists?

> -----Original Message-----
> From:	[email-masked] [SMTP:[email-masked]]
> Sent:	Friday, August 21, 1998 10:43 AM
> To:	[email-masked]; [email-masked]
> Subject:	Re: Lunch meeting Chicago Tuesday 11:30 
> 

From: Bruce Greenblatt <[email-masked]>
To: [email-masked], [email-masked], [email-masked]
Subject: RE: Lunch meeting Chicago Tuesday 11:30 
Date: Fri, 21 Aug 1998 10:49:39 -0700
Sender: [email-masked]

For those of us unfortunate enough to be unable to make it to Chicago, can
someone (Chris?) please take notes, and post them to the appropriate mailing
lists?

> -----Original Message-----
> From:	[email-masked] [SMTP:[email-masked]]
> Sent:	Friday, August 21, 1998 10:43 AM
> To:	[email-masked]; [email-masked]
> Subject:	Re: Lunch meeting Chicago Tuesday 11:30 
> 

Subject: Re: Lunch meeting Chicago Tuesday 11:30 
To: [email-masked], [email-masked]
From: [email-masked]
Date: Fri, 21 Aug 1998 10:42:50 -0700
Sender: [email-masked]

Jeff

Date: Fri, 21 Aug 1998 09:37:57 -0700 (PDT)
From: Chris Newman <[email-masked]>
Subject: Lunch meeting Chicago Tuesday 11:30
Originator-info: login-id=chris; server=THOR.INNOSOFT.COM
To: [email-masked]
Sender: [email-masked]

		- Chris

Date: Mon, 10 Aug 1998 14:49:51 -0500
From: Mark Wahl <[email-masked]>
Subject: Re: Information about SASL implementations required
To: Alexey Melnikov <[email-masked]>
Cc: [email-masked]
Sender: [email-masked]

The Innosoft Distributed Directory Server, Innosoft LDAP Administrative Shell
and Innosoft LDAP Client SDK support SASL in LDAPv3.  We use the mechanisms
"CRAM-MD5" for password protection, and "EXTERNAL" following Start TLS for 
specifying use of TLS-exchanged client identity.

Mark Wahl, Directory Product Architect
Innosoft International, Inc.

Date: Mon, 10 Aug 1998 23:34:14 +0400
From: Alexey Melnikov <[email-masked]>
Organization: Epsylon Technologies
To: IMAP Discusson List <[email-masked]>
CC: [email-masked]
Subject: Information about SASL implementations required
Sender: [email-masked]

I've decided to create new informational page (for public use) about
clients&servers (SMTP/POP3/IMAP4/ACAP/LDAP) supporting SASL.
Any information will be appreciated.
Please, send information to me directly.

(Personally I am interested to know about servers that support SKEY
and/or CRAM-MD5)

Regards,
Alexey Melnikov
------------------------------------------
SMTP/POP3/IMAP4/ACAP servers creation team
"ACAP Explorer" client
Imap Development Kit (my own product)

Epsylon Technologies, Russia
 http://www.demo.ru
------------------------------------------

Date: Mon, 03 Aug 1998 14:04:33 -0700
From: Jeff Hodges <[email-masked]>
To: [email-masked]
CC: [email-masked]
Subject: overall sasl client-server interaction diagram
Sender: [email-masked]

I recently drew up the below diagram for an analysis I did (on Netscape Dir
server's SASL support, (see netscape.server.directory on
secnews.netscape.com)). I'm forwarding it along in case 
you folks think it might be useful in a future revision of the SASL doc. I
think it'd be an improvement to the doc to have this or something like it in
there. 

Jeff

				.
				.
				.
				.
Negotiation of SASL-initiated authentication mechanisms typically consists of
at least two round trips between the client and server..

         client                                    server
           |                                         |
time       | "Open application-protocol connection   |
 |         |  on top of TCP"                         |
 |         +---------------------------------------->|
 |         |                                         |
 V         |                                         |
           | "Connection is opened"                  |
           |<----------------------------------------+
           |                                         |
           |                                         |
           |                                         |
  ---  --- | ----  -----  -----  -----  -----  ----- | ---  ----
    ^      |                                         |
    |      |                                         |
    |      |  "begin authentication, and let's use   |
    |      |   this XXX mechanism"                   |
    |      +---------------------------------------->|
    |      |                                         |
    |      |                                         |
    |      |  "Ok, I'll ~challenge~ you."            |
    |      |<----------------------------------------+
    |      |                                         |
    |      |                                         |
    |      |  "Here's my response, (sometimes)       |
    |      |   containing my credentials             |
    |      |   (depending upon selected mechanism)   |
    |      +---------------------------------------->|
    |      |                                         |
    |      |                                         |
    |                          .
 (SASL Negotiation             . [some number of messages,
  Happens Here)                .  from 0 to N, may be 
    |                          .  exchanged here in order 
    |                          .  to negotiate authentication
    |                          .  and optionally a security
    |                          .  layer.]
    |                          .
    |                          .
    |      |                                         |
    |      |                                         |
    |      |  "Ok, you're auth'd" (plus optionally:  |
    |      |  "and the security layer is set up")    |
    |      |<----------------------------------------+
    V      |                                         |
  ---  --- | ----  -----  -----  -----  -----  ----- | ---  ----
           |                                         |
           |                                         |
           V                                         V
                               .
                               . [client and server begin
                               .  communicating using the 
                               .  protocol, over the
                               .  the optionally secure
                               .  connection]
                               .
                               V

Where:

  XXX = KERBEROS_V4, CRAM_MD5, GSSAPI, SKEY, EXTERNAL, ANONYMOUS

  see: ftp://ftp.isi.edu/in-notes/iana/assignments/sasl-mechanisms